Summary
It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when
an early failure occurred. An authenticated user could possibly use this
issue to execute arbitrary SQL commands. (CVE-2026-6464)
It was discovered that PostgreSQL incorrectly reset extended statistics
ownership during ALTER TABLE ALTER TYPE operations. An attacker could
possibly use this issue to obtain sensitive information or gain unintended
privileges. (CVE-2026-6469)
It was discovered that PostgreSQL failed to check the USAGE privilege on
types. An authenticated user could possibly use this issue to obtain
sensitive information. (CVE-2026-6470)
It was discovered that PostgreSQL logical decoding could load arbitrary
shared libraries. An authenticated user could possibly use this issue to
execute arbitrary code. (CVE-2026-6471)
It was discovered that PostgreSQL had integer wraparound issues in tsvector
and tsquery allocations. An authenticated user could possibly use this
issue to execute arbitrary code. (CVE-2026-14662)
It was discovered that PostgreSQL pgcrypto silently used cleartext when
OpenSSL-disabled ciphers were requested. An authenticated user could
possibly use this issue to obtain sensitive information. (CVE-2026-14663)
It was discovered that PostgreSQL had a heap buffer overflow in regular
expression processing. An authenticated user could possibly use this issue
to execute arbitrary code. (CVE-2026-14664)
It was discovered that PostgreSQL row security policies were not properly
invalidated when roles were modified. An attacker could possibly use this
issue to bypass intended row security restrictions. (CVE-2026-14666)
It was discovered that PostgreSQL had a type confusion issue in the
selectivity estimator involving ctid. An authenticated user could possibly
use this issue to obtain sensitive information. (CVE-2026-14668)
It was discovered that PostgreSQL had a heap buffer overflow in the to_char
function. An authenticated user could possibly use this issue to execute
arbitrary code. (CVE-2026-14669)
It was discovered that PostgreSQL had a heap buffer overflow in the PL/Perl
tied object handling. An authenticated user could possibly use this issue
to execute arbitrary code. (CVE-2026-14670)
It was discovered that PostgreSQL had a type confusion issue in the
referential integrity plan cache. An authenticated user could possibly use
this issue to execute arbitrary code. (CVE-2026-14671)
It was discovered that PostgreSQL had an observable response discrepancy
when non-default scram_iterations were used. A remote attacker could
possibly use this issue to enumerate valid usernames. This issue only
affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-14672)
It was discovered that PostgreSQL amcheck did not clear untrusted search
paths. An authenticated user could possibly use this issue to execute
arbitrary code. (CVE-2026-14673)
It was discovered that PostgreSQL had a heap buffer overflow in
pg_stat_statements. An authenticated user could possibly use this issue to
execute arbitrary code. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-14676)
It was discovered that PostgreSQL had integer wraparound issues in PL/Tcl
and PL/Perl allocations on 32-bit systems. An authenticated user could
possibly use this issue to execute arbitrary code. (CVE-2026-14677)
It was discovered that PostgreSQL pg_trgm read past the end of a buffer
during picksplit operations. An authenticated user could possibly use this
issue to obtain sensitive information. (CVE-2026-14678)
It was discovered that PostgreSQL had a stack buffer overflow in argument
matching. An authenticated user could possibly use this issue to corrupt
server memory. (CVE-2026-14679)
It was discovered that PostgreSQL had a type confusion issue when functions
used internal arguments. An authenticated user could possibly use this
issue to execute arbitrary code. (CVE-2026-14680)
It was discovered that PostgreSQL did not properly enforce GSSAPI
encryption when used together with SSL. An attacker could possibly use this
issue to perform a machine-in-the-middle attack and obtain sensitive
information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14681)
It was discovered that PostgreSQL allowed SQL injection through EXTRACT
arguments during expression deparsing. An authenticated user could possibly
use this issue to perform SQL injection attacks. (CVE-2026-15741)
It was discovered that PostgreSQL fuzzystrmatch had integer wraparound
issues that could write to arbitrary addresses. An authenticated user could
possibly use this issue to execute arbitrary code. (CVE-2026-15742)
It was discovered that PostgreSQL had a type confusion issue in
pg_restore_attribute_stats(). An authenticated user could possibly use this
issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-16238)
It was discovered that PostgreSQL had a type confusion issue when handling
cursor CLOSE and DECLARE operations. An authenticated user could possibly
use this issue to execute arbitrary code. (CVE-2026-16239)
It was discovered that PostgreSQL had an integer underflow in the ECPG
client library. An attacker could possibly use this issue to cause
PostgreSQL to crash, resulting in a denial of service. (CVE-2026-16241)
It was discovered that PostgreSQL had an out-of-bounds read in the ascii()
function. An authenticated user could possibly use this issue to obtain
sensitive information. (CVE-2026-18024)
It was discovered that the psql \unrestrict command allowed the superuser
of a pg_dump origin server to execute arbitrary code in the psql client. An
attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-18408)
It was discovered that PostgreSQL pg_dump had a heap buffer overflow. An
attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-19385)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | postgresql-14 | 14.24-0ubuntu0.22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | postgresql-16 | 16.15-0ubuntu0.24.04.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | postgresql-18 | 18.6-0ubuntu0.26.04.1 |
Vulnerabilities 30
-
High 8.8CVE-2025-8714 Public exploit
PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall…
-
High 8.8CVE-2026-14662 Public exploit
PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound
Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating s…
-
High 8.8
PostgreSQL regexp heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved un…
-
High 8.8CVE-2026-14669 Public exploit
PostgreSQL to_char heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, …
-
High 8.8
PostgreSQL plperl tied object heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24…
-
High 8.8
PostgreSQL refint plan cache type confusion executes arbitrary code
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "re…
-
High 8.8
PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQ…
-
High 8.8
PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user runnin…
-
High 8.8
PostgreSQL type confusion via "internal" arguments
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompati…
-
High 8.8
PostgreSQL expression deparse allows SQL injection via EXTRACT argument
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage…
-
High 8.8
PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(…
-
High 8.8
PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code
Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before Postg…
-
High 8.8
PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11, 16.15, …
-
High 8.8
PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command in…
-
High 8.8
PostgreSQL pg_dump heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, an…
-
High 8.8
PostgreSQL server undersizes allocations, via integer wraparound
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applic…
-
High 8.2
PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory
Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
-
High 8.1
PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read
Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, …
-
High 8.1
PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits …
-
High 7.2CVE-2026-6471 Public exploit
PostgreSQL logical decoding can dlopen arbitrary file
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary cod…
-
Medium 6.5
PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted d…
-
Medium 5.3
PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the …
-
Medium 4.3
PostgreSQL pg_trgm picksplit reads past end of buffer
Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.6, 17.11, 16.15, 15…
-
Medium 4.3
PostgreSQL ascii() function reads past end of buffer
Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Vers…
-
Medium 4.3
PostgreSQL fails to check type USAGE privilege
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and re…
-
Medium 4.2
PostgreSQL row security caching disregards role modifications
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continu…
-
Medium 4.2
PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data o…
-
Low 3.8
PostgreSQL amcheck does not clear untrusted search path
Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck …
-
Low 3.8
PostgreSQL ECPG integer underflow can crash the client
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside at…
-
Low 3.8
PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership
Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. I…
References
-
report
https://ubuntu.com/security/CVE-2025-8714
-
report
https://ubuntu.com/security/CVE-2026-6464
-
report
https://ubuntu.com/security/CVE-2026-6469
-
report
https://ubuntu.com/security/CVE-2026-6470
-
report
https://ubuntu.com/security/CVE-2026-6471
-
report
https://ubuntu.com/security/CVE-2026-6473
-
report
https://ubuntu.com/security/CVE-2026-14662
-
report
https://ubuntu.com/security/CVE-2026-14663
-
report
https://ubuntu.com/security/CVE-2026-14664
-
report
https://ubuntu.com/security/CVE-2026-14666
-
report
https://ubuntu.com/security/CVE-2026-14668
-
report
https://ubuntu.com/security/CVE-2026-14669
-
report
https://ubuntu.com/security/CVE-2026-14670
-
report
https://ubuntu.com/security/CVE-2026-14671
-
report
https://ubuntu.com/security/CVE-2026-14672
-
report
https://ubuntu.com/security/CVE-2026-14673
-
report
https://ubuntu.com/security/CVE-2026-14676
-
report
https://ubuntu.com/security/CVE-2026-14677
-
report
https://ubuntu.com/security/CVE-2026-14678
-
report
https://ubuntu.com/security/CVE-2026-14679
-
report
https://ubuntu.com/security/CVE-2026-14680
-
report
https://ubuntu.com/security/CVE-2026-14681
-
report
https://ubuntu.com/security/CVE-2026-15741
-
report
https://ubuntu.com/security/CVE-2026-15742
-
report
https://ubuntu.com/security/CVE-2026-16238
-
report
https://ubuntu.com/security/CVE-2026-16239
-
report
https://ubuntu.com/security/CVE-2026-16241
-
report
https://ubuntu.com/security/CVE-2026-18024
-
report
https://ubuntu.com/security/CVE-2026-18408
-
report
https://ubuntu.com/security/CVE-2026-19385